asyncrat | 639f3b93a0cdc1176c914ab5ca64bfe3763ed3973d80198de064310be16ca65f

Sharing

Copy URL Twitter E-mail

General

Target
639f3b93a0cdc1176c914ab5ca64bfe3763ed3973d80198de064310be16ca65f
Size 45KB
Sample260718-qlw67acv2l
SHA256 639f3b93a0cdc1176c914ab5ca64bfe3763ed3973d80198de064310be16ca65f
MD5 54b5ee61f9f4a5baf9324c980e1df68c
SHA1 2f719c34ad5b1233510c943fb2d459df1539eda5
SHA512 bca4a5c0045d0ed8882b9e24ea540bd1fcdd30b5af43fa6d3ddd1ded13f8581a58bcbb2013f0e58a1762d544a6bb71c762ccbfc55ba70ba78297b972df0d8aa9
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQvjb0gX3iZ9tcdARspuswTBDZsx:EulCJTHl42sU3QbbbXSCKRIusedsx
TLSH
T1EE231A003BE8C12BF2BE4B74A9F26145867AF2677603D58D2CC451DB5623FC58A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
ryuk.sexsexviet.com:80
ryuk.sexsexviet.com:22
ryuk.sexsexviet.com:8080
ryuk.sexsexviet.com:8880
ryuk.sexsexviet.com:2052
ryuk.sexsexviet.com:2082
ryuk.sexsexviet.com:2086
ryuk.sexsexviet.com:2095
ryuk.sexsexviet.com:443
ryuk.sexsexviet.com:2053
ryuk.sexsexviet.com:2083
ryuk.sexsexviet.com:2087
ryuk.sexsexviet.com:2096
ryuk.sexsexviet.com:8443
cl0p.sexsexviet.com:80
cl0p.sexsexviet.com:22
cl0p.sexsexviet.com:8080
cl0p.sexsexviet.com:8880
cl0p.sexsexviet.com:2052
cl0p.sexsexviet.com:2082
cl0p.sexsexviet.com:2086
cl0p.sexsexviet.com:2095
cl0p.sexsexviet.com:443
cl0p.sexsexviet.com:2053
cl0p.sexsexviet.com:2083
cl0p.sexsexviet.com:2087
cl0p.sexsexviet.com:2096
cl0p.sexsexviet.com:8443
cryptolocker.sexsexviet.com:80
cryptolocker.sexsexviet.com:22
cryptolocker.sexsexviet.com:8080
cryptolocker.sexsexviet.com:8880
cryptolocker.sexsexviet.com:2052
cryptolocker.sexsexviet.com:2082
cryptolocker.sexsexviet.com:2086
cryptolocker.sexsexviet.com:2095
cryptolocker.sexsexviet.com:443
cryptolocker.sexsexviet.com:2053
cryptolocker.sexsexviet.com:2083
cryptolocker.sexsexviet.com:2087
cryptolocker.sexsexviet.com:2096
cryptolocker.sexsexviet.com:8443

Mutex

RerOR7Brn17l

Attributes

delay
0
install
true
install_file
5p0bab.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  639f3b93a0cdc1176c914ab5ca64bfe3763ed3973d80198de064310be16ca65f
- Size 45KB
- SHA256 639f3b93a0cdc1176c914ab5ca64bfe3763ed3973d80198de064310be16ca65f
- MD5 54b5ee61f9f4a5baf9324c980e1df68c
- SHA1 2f719c34ad5b1233510c943fb2d459df1539eda5
- SHA512 bca4a5c0045d0ed8882b9e24ea540bd1fcdd30b5af43fa6d3ddd1ded13f8581a58bcbb2013f0e58a1762d544a6bb71c762ccbfc55ba70ba78297b972df0d8aa9
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQvjb0gX3iZ9tcdARspuswTBDZsx:EulCJTHl42sU3QbbbXSCKRIusedsx
- TLSH
  T1EE231A003BE8C12BF2BE4B74A9F26145867AF2677603D58D2CC451DB5623FC58A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2